@ixiam/n8n-nodes-civicrm 3.2.3 → 3.3.0

package/README.md

@@ -157,6 +157,21 @@ Option 2: Regenerate API Key (CiviCRM)
 
 After entering credentials, click **Test credentials** to validate the connection.
 
+### **Base URL Override (v3.3.0+)**
+
+One credential can target many CiviCRM instances that share the same API key. Set the node's **Base URL Override** field, usually with an expression, and every request for that item goes to that URL instead of the credential's Base URL.
+
+| Field | Description |
+|-------|-------------|
+| **Base URL Override** | Optional. Site root, without `/civicrm`. Example: `={{ $json.instance_url }}` |
+
+- Normalized per item: trimmed, trailing slashes removed, `https://` added when no scheme is given. Only `http://` and `https://` are accepted; anything else fails that item (honors *Continue On Fail*).
+- Applies to every request for the item, including sub-requests, the JWT flow and the API key fallback. JWT and contact ID caches are keyed by the effective URL, so a token from one instance is never sent to another.
+- Empty (the default, and every workflow saved before 3.3.0): the credential's Base URL is used, exactly as before.
+- Dropdowns in the editor (`loadOptions`) have no item context and always use the credential's Base URL.
+
+> ⚠️ The credential's API key is sent to whatever URL the override resolves to. Only feed it URLs your workflow controls (a fixed list, or a source only trusted people can edit).
+
 ---
 
 ## 📦 Supported Entities

package/dist/src/nodes/CiviCrm/CiviCrm.node.js

@@ -21,16 +21,21 @@ function normalizeLocationKey(s) {
         .toLowerCase()
         .replace(/[^a-z0-9]+/g, '');
 }
-async function getLocationTypeMap() {
-    const credentials = await this.getCredentials('civiCrmApi');
-    const baseUrl = String((credentials === null || credentials === void 0 ? void 0 : credentials.baseUrl) || 'default');
+async function getLocationTypeMap(baseUrlOverride) {
+    // Cache keyed by the effective base URL (override if set, else credential)
+    // so location types of one CiviCRM instance are never reused for another.
+    let baseUrl = baseUrlOverride;
+    if (!baseUrl) {
+        const credentials = await this.getCredentials('civiCrmApi');
+        baseUrl = String((credentials === null || credentials === void 0 ? void 0 : credentials.baseUrl) || 'default');
+    }
     if (locationTypeCache[baseUrl])
         return locationTypeCache[baseUrl];
     const res = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/OptionValue/get', {
         where: [['option_group_id:name', '=', 'location_type']],
         select: ['name', 'label'],
         limit: 0,
-    });
+    }, undefined, baseUrlOverride);
     const map = {};
     const values = ((res === null || res === void 0 ? void 0 : res.values) || []);
     for (const v of values) {
@@ -708,6 +713,21 @@ class CiviCrm {
                     },
                 },
                 //
+                // BASE URL OVERRIDE (per item: one credential / API key shared by
+                // several CiviCRM instances - see GenericFunctions.civicrmApiRequest)
+                //
+                {
+                    displayName: 'Base URL Override',
+                    name: 'baseUrlOverride',
+                    type: 'string',
+                    default: '',
+                    placeholder: 'https://example.org',
+                    description: "Optional. Replaces the credential's Base URL for this item (site root, without /civicrm). " +
+                        'Useful for many instances sharing the same API key. Can be set by expression, e.g. ' +
+                        '={{ $json.instance_url }}. If no scheme is given, https:// is assumed; only http(s) is allowed. ' +
+                        "Leave empty to use the credential's Base URL.",
+                },
+                //
                 // DYNAMIC FIELDS
                 //
                 ...generic_1.genericFields,
@@ -764,6 +784,11 @@ class CiviCrm {
                 // actual CiviCRM permissions, defeating the point of issue #25 for
                 // every write operation.
                 const runtimeBearerToken = this.getNodeParameter('runtimeBearerToken', i, '').trim() || undefined;
+                // Per-item Base URL Override: same credential/API key, different
+                // CiviCRM instance per item. Normalized/validated here (inside the
+                // per-item try so continueOnFail applies) and passed to every
+                // civicrmApiRequest call for this item. Empty -> credential Base URL.
+                const baseUrlOverride = (0, GenericFunctions_1.normalizeBaseUrlOverride)(this.getNode(), this.getNodeParameter('baseUrlOverride', i, ''), i);
                 // Custom API resource: raw passthrough, plus first-class List Fields /
                 // Dynamic Search operations for any API4 entity (not just the 5 fixed
                 // resources above).
@@ -778,7 +803,7 @@ class CiviCrm {
                     -------------------------------------------------------- */
                     if (customOperation === 'getFields') {
                         const actionContext = this.getNodeParameter('getFieldsAction', i, 'get');
-                        const res = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${customEntity}/getFields`, { action: actionContext, loadOptions: true }, runtimeBearerToken);
+                        const res = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${customEntity}/getFields`, { action: actionContext, loadOptions: true }, runtimeBearerToken, baseUrlOverride);
                         const vals = ((_a = res === null || res === void 0 ? void 0 : res.values) !== null && _a !== void 0 ? _a : []);
                         if (Array.isArray(vals) && vals.length) {
                             for (const v of vals) {
@@ -821,7 +846,7 @@ class CiviCrm {
                             const page = 500;
                             let hasMore = true;
                             while (hasMore) {
-                                const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${customEntity}/get`, { select, where, limit: page, offset }, runtimeBearerToken);
+                                const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${customEntity}/get`, { select, where, limit: page, offset }, runtimeBearerToken, baseUrlOverride);
                                 const vals = ((_c = r === null || r === void 0 ? void 0 : r.values) !== null && _c !== void 0 ? _c : []);
                                 for (const v of vals) {
                                     out.push({ json: v, pairedItem: { item: i } });
@@ -835,7 +860,7 @@ class CiviCrm {
                             }
                         }
                         else {
-                            const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${customEntity}/get`, { select, where, limit }, runtimeBearerToken);
+                            const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${customEntity}/get`, { select, where, limit }, runtimeBearerToken, baseUrlOverride);
                             const vals = ((_d = r === null || r === void 0 ? void 0 : r.values) !== null && _d !== void 0 ? _d : []);
                             for (const v of vals) {
                                 out.push({ json: v, pairedItem: { item: i } });
@@ -857,7 +882,7 @@ class CiviCrm {
                             throw new Error('Invalid JSON in "Params (JSON)"');
                         }
                     }
-                    const res = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${customEntity}/${action}`, params, runtimeBearerToken);
+                    const res = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${customEntity}/${action}`, params, runtimeBearerToken, baseUrlOverride);
                     // Return the raw API4 response so advanced users can work with values and metadata
                     out.push({
                         json: res,
@@ -906,7 +931,7 @@ class CiviCrm {
                             limit: 1,
                             select: ['id', 'name', 'title', 'subject', 'display_name'],
                         };
-                    const res = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/get`, params, runtimeBearerToken);
+                    const res = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/get`, params, runtimeBearerToken, baseUrlOverride);
                     out.push({
                         json: (_f = (_e = res === null || res === void 0 ? void 0 : res.values) === null || _e === void 0 ? void 0 : _e[0]) !== null && _f !== void 0 ? _f : {},
                         pairedItem: { item: i },
@@ -964,7 +989,7 @@ class CiviCrm {
                         const page = 500;
                         let hasMore = true;
                         while (hasMore) {
-                            const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/get`, { ...params, limit: page, offset }, runtimeBearerToken);
+                            const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/get`, { ...params, limit: page, offset }, runtimeBearerToken, baseUrlOverride);
                             const vals = (_g = r === null || r === void 0 ? void 0 : r.values) !== null && _g !== void 0 ? _g : [];
                             for (const v of vals) {
                                 out.push({
@@ -981,7 +1006,7 @@ class CiviCrm {
                         }
                     }
                     else {
-                        const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/get`, { ...params, limit }, runtimeBearerToken);
+                        const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/get`, { ...params, limit }, runtimeBearerToken, baseUrlOverride);
                         const vals = (_h = r === null || r === void 0 ? void 0 : r.values) !== null && _h !== void 0 ? _h : [];
                         for (const v of vals) {
                             out.push({
@@ -999,7 +1024,7 @@ class CiviCrm {
                     const id = this.getNodeParameter('id', i);
                     const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/delete`, {
                         where: [['id', '=', id]],
-                    }, runtimeBearerToken);
+                    }, runtimeBearerToken, baseUrlOverride);
                     out.push({
                         json: {
                             success: true,
@@ -1023,7 +1048,7 @@ class CiviCrm {
                 const addressData = {};
                 let locationTypeMap = {};
                 if (resource === 'contact') {
-                    locationTypeMap = await getLocationTypeMap.call(this);
+                    locationTypeMap = await getLocationTypeMap.call(this, baseUrlOverride);
                 }
                 for (const p of pairs) {
                     if (!p.fieldName)
@@ -1135,7 +1160,7 @@ class CiviCrm {
                 /* CREATE/UPDATE contact */
                 let contactId = id;
                 if (isCreate) {
-                    const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/create`, { values }, runtimeBearerToken);
+                    const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/create`, { values }, runtimeBearerToken, baseUrlOverride);
                     contactId = (_k = (_j = r === null || r === void 0 ? void 0 : r.values) === null || _j === void 0 ? void 0 : _j[0]) === null || _k === void 0 ? void 0 : _k.id;
                     if (!contactId)
                         throw new Error('Failed to create contact.');
@@ -1144,7 +1169,7 @@ class CiviCrm {
                     await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/update`, {
                         values,
                         where: [['id', '=', contactId]],
-                    }, runtimeBearerToken);
+                    }, runtimeBearerToken, baseUrlOverride);
                 }
                 /* SUBENTITIES */
                 if (resource === 'contact') {
@@ -1154,7 +1179,7 @@ class CiviCrm {
                                 ['contact_id', '=', contactId],
                                 ['is_primary', '=', true],
                             ],
-                        }, runtimeBearerToken);
+                        }, runtimeBearerToken, baseUrlOverride);
                     }
                     if (isCreate && isPrimaryPhone) {
                         await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Phone/delete', {
@@ -1162,7 +1187,7 @@ class CiviCrm {
                                 ['contact_id', '=', contactId],
                                 ['is_primary', '=', true],
                             ],
-                        }, runtimeBearerToken);
+                        }, runtimeBearerToken, baseUrlOverride);
                     }
                     if (isCreate && isPrimaryAddress) {
                         await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Address/delete', {
@@ -1170,7 +1195,7 @@ class CiviCrm {
                                 ['contact_id', '=', contactId],
                                 ['is_primary', '=', true],
                             ],
-                        }, runtimeBearerToken);
+                        }, runtimeBearerToken, baseUrlOverride);
                     }
                     if (Object.keys(emailData).length) {
                         if (isCreate) {
@@ -1181,7 +1206,7 @@ class CiviCrm {
                                     is_primary: isPrimaryEmail,
                                     'location_type_id:name': emailLocationName,
                                 },
-                            }, runtimeBearerToken);
+                            }, runtimeBearerToken, baseUrlOverride);
                         }
                         else {
                             const existingEmail = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Email/get', {
@@ -1191,7 +1216,7 @@ class CiviCrm {
                                 ],
                                 limit: 1,
                                 select: ['id'],
-                            }, runtimeBearerToken);
+                            }, runtimeBearerToken, baseUrlOverride);
                             const existingEmailId = (_m = (_l = existingEmail === null || existingEmail === void 0 ? void 0 : existingEmail.values) === null || _l === void 0 ? void 0 : _l[0]) === null || _m === void 0 ? void 0 : _m.id;
                             if (existingEmailId) {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Email/update', {
@@ -1201,7 +1226,7 @@ class CiviCrm {
                                         contact_id: contactId,
                                         is_primary: isPrimaryEmail,
                                     },
-                                }, runtimeBearerToken);
+                                }, runtimeBearerToken, baseUrlOverride);
                             }
                             else {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Email/create', {
@@ -1211,7 +1236,7 @@ class CiviCrm {
                                         is_primary: isPrimaryEmail,
                                         'location_type_id:name': emailLocationName,
                                     },
-                                }, runtimeBearerToken);
+                                }, runtimeBearerToken, baseUrlOverride);
                             }
                         }
                     }
@@ -1224,7 +1249,7 @@ class CiviCrm {
                                     is_primary: isPrimaryPhone,
                                     'location_type_id:name': phoneLocationName,
                                 },
-                            }, runtimeBearerToken);
+                            }, runtimeBearerToken, baseUrlOverride);
                         }
                         else {
                             const existingPhone = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Phone/get', {
@@ -1234,7 +1259,7 @@ class CiviCrm {
                                 ],
                                 limit: 1,
                                 select: ['id'],
-                            }, runtimeBearerToken);
+                            }, runtimeBearerToken, baseUrlOverride);
                             const existingPhoneId = (_p = (_o = existingPhone === null || existingPhone === void 0 ? void 0 : existingPhone.values) === null || _o === void 0 ? void 0 : _o[0]) === null || _p === void 0 ? void 0 : _p.id;
                             if (existingPhoneId) {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Phone/update', {
@@ -1244,7 +1269,7 @@ class CiviCrm {
                                         contact_id: contactId,
                                         is_primary: isPrimaryPhone,
                                     },
-                                }, runtimeBearerToken);
+                                }, runtimeBearerToken, baseUrlOverride);
                             }
                             else {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Phone/create', {
@@ -1254,7 +1279,7 @@ class CiviCrm {
                                         is_primary: isPrimaryPhone,
                                         'location_type_id:name': phoneLocationName,
                                     },
-                                }, runtimeBearerToken);
+                                }, runtimeBearerToken, baseUrlOverride);
                             }
                         }
                     }
@@ -1267,7 +1292,7 @@ class CiviCrm {
                                     is_primary: isPrimaryAddress,
                                     'location_type_id:name': addressLocationName,
                                 },
-                            }, runtimeBearerToken);
+                            }, runtimeBearerToken, baseUrlOverride);
                         }
                         else {
                             const existingAddress = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Address/get', {
@@ -1277,7 +1302,7 @@ class CiviCrm {
                                 ],
                                 limit: 1,
                                 select: ['id'],
-                            }, runtimeBearerToken);
+                            }, runtimeBearerToken, baseUrlOverride);
                             const existingAddressId = (_r = (_q = existingAddress === null || existingAddress === void 0 ? void 0 : existingAddress.values) === null || _q === void 0 ? void 0 : _q[0]) === null || _r === void 0 ? void 0 : _r.id;
                             if (existingAddressId) {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Address/update', {
@@ -1287,7 +1312,7 @@ class CiviCrm {
                                         contact_id: contactId,
                                         is_primary: isPrimaryAddress,
                                     },
-                                }, runtimeBearerToken);
+                                }, runtimeBearerToken, baseUrlOverride);
                             }
                             else {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Address/create', {
@@ -1297,7 +1322,7 @@ class CiviCrm {
                                         is_primary: isPrimaryAddress,
                                         'location_type_id:name': addressLocationName,
                                     },
-                                }, runtimeBearerToken);
+                                }, runtimeBearerToken, baseUrlOverride);
                             }
                         }
                     }
@@ -1326,7 +1351,7 @@ class CiviCrm {
                             },
                         }
                         : {}),
-                }, runtimeBearerToken);
+                }, runtimeBearerToken, baseUrlOverride);
                 out.push({
                     json: (_t = (_s = res === null || res === void 0 ? void 0 : res.values) === null || _s === void 0 ? void 0 : _s[0]) !== null && _t !== void 0 ? _t : {},
                     pairedItem: { item: i },

package/dist/src/nodes/transport/GenericFunctions.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeBaseUrlOverride = normalizeBaseUrlOverride;
 exports.buildCiviAuthHeaders = buildCiviAuthHeaders;
 exports.civicrmApiRequest = civicrmApiRequest;
 exports.api4 = api4;
@@ -37,6 +38,46 @@ function getHttpErrorDetails(error) {
     }
     return status ? `${message} | HTTP ${status}` : message;
 }
+/**
+ * Normalizes the optional per-item "Base URL Override" parameter.
+ *
+ * - Empty / whitespace-only -> `undefined` (caller uses the credential's Base URL).
+ * - Trims, strips trailing slashes, prepends `https://` when no scheme is given.
+ * - Rejects any scheme other than http/https, and anything that does not parse
+ *   as a URL with a host, with a NodeOperationError.
+ *
+ * Idempotent: normalizing an already-normalized value returns the same string,
+ * so it is safe to call both in the node and in the transport.
+ */
+function normalizeBaseUrlOverride(node, rawValue, itemIndex) {
+    if (rawValue === undefined || rawValue === null)
+        return undefined;
+    let value = String(rawValue).trim();
+    if (!value)
+        return undefined;
+    value = value.replace(/\/+$/, '');
+    const schemeMatch = /^([a-z][a-z0-9+.-]*):\/\//i.exec(value);
+    if (schemeMatch) {
+        const scheme = schemeMatch[1].toLowerCase();
+        if (scheme !== 'http' && scheme !== 'https') {
+            throw new n8n_workflow_1.NodeOperationError(node, `Invalid Base URL Override "${value}": only http:// and https:// URLs are allowed (got "${scheme}://").`, { itemIndex });
+        }
+    }
+    else {
+        value = `https://${value}`;
+    }
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new n8n_workflow_1.NodeOperationError(node, `Invalid Base URL Override "${String(rawValue).trim()}": not a valid URL. Expected the site root, e.g. https://example.org`, { itemIndex });
+    }
+    if ((parsed.protocol !== 'http:' && parsed.protocol !== 'https:') || !parsed.hostname) {
+        throw new n8n_workflow_1.NodeOperationError(node, `Invalid Base URL Override "${String(rawValue).trim()}": only http:// and https:// URLs with a host are allowed.`, { itemIndex });
+    }
+    return value;
+}
 function buildCiviAuthHeaders(credentials, baseUrl, jwtToken) {
     const headers = {
         'Content-Type': 'application/x-www-form-urlencoded',
@@ -64,11 +105,20 @@ function buildCiviAuthHeaders(credentials, baseUrl, jwtToken) {
  * (JWT auto-resolve via `getServerIssuedJwt`/`resolveContactId`, or the
  * empty-response/error fallback to the credential's API key) runs at all.
  * See the early-return block right below for why.
+ *
+ * `baseUrlOverride` (optional) replaces the credential's Base URL for this
+ * call (per-item "Base URL Override" parameter), so a single credential/API key
+ * can target several CiviCRM instances. It is used for every request made by
+ * this call, including the JWT paths (Contact/get auto-resolve,
+ * AuthxCredential/create) and the API key fallback. The JWT caches in JwtAuth
+ * are keyed by this effective base URL, so a token issued by one instance is
+ * never sent to another. Empty/undefined -> credential Base URL, unchanged.
  */
-async function civicrmApiRequest(method, path, body, runtimeBearerToken) {
+async function civicrmApiRequest(method, path, body, runtimeBearerToken, baseUrlOverride) {
     var _a, _b, _c, _d;
     const credentials = (await this.getCredentials('civiCrmApi'));
-    const baseUrl = credentials.baseUrl.replace(/\/$/, '');
+    const normalizedOverride = normalizeBaseUrlOverride(this.getNode(), baseUrlOverride);
+    const baseUrl = normalizedOverride !== null && normalizedOverride !== void 0 ? normalizedOverride : credentials.baseUrl.replace(/\/$/, '');
     const apiToken = credentials.apiToken;
     // Runtime bearer token path: used exactly as given, with no fallback.
     //
@@ -81,11 +131,18 @@ async function civicrmApiRequest(method, path, body, runtimeBearerToken) {
     // path below has (empty JWT response -> retry with the plaintext API key),
     // and it is exactly what must NOT happen here, so this path never falls
     // through into that logic.
+    //
+    // The token is sent with the same header(s) as the credential's JWT path
+    // (`jwtHeaderMode`, default `xheader` = X-Civi-Auth). A hardcoded
+    // `Authorization` header is not enough: many nginx + PHP-FPM setups do not
+    // pass it to PHP, so CiviCRM sees an unauthenticated request and rejects it
+    // ("SECURITY ALERT: Ajax requests can only be issued by javascript
+    // clients"). X-Civi-Auth always reaches CiviCRM.
     if (runtimeBearerToken) {
         const headers = {
             'Content-Type': 'application/x-www-form-urlencoded',
-            Authorization: `Bearer ${runtimeBearerToken}`,
         };
+        applyJwtHeaders(headers, runtimeBearerToken, getJwtHeaderMode(credentials));
         const options = {
             method,
             url: `${baseUrl}${path}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ixiam/n8n-nodes-civicrm",
-  "version": "3.2.3",
+  "version": "3.3.0",
   "description": "Full-featured CiviCRM API v4 integration for n8n",
   "license": "MIT",
   "keywords": [